Prepare Isaca CRISC Exam with Real Exam Questions – Isaca CRISC dumps

1. Isaca Exam CRISC Certified in Risk and Information Systems Control Verson: Demo [ Total Questions: 10 ]

2. Topic 1, Volume A Question No : 1 - (Topic 1) The only output of qualitative risk analysis is risk register updates. When the project manager updates the risk register he will need to include several pieces of information including all of the following except for which one? A. Trends in qualitative risk analysis B. Risk probability-impact matrix C. Risks grouped by categories D. Watchlist of low-priority risks Answer: B Explanation: The risk matrix is not included as part of the risk register updates. There are seven things that can be updated in the risk register as a result of qualitative risk analysis: relating ranking of project risks, risks grouped by categories, causes of risks, list of near-term risks, risks requiring additional analysis, watchlist of low-priority risks, trends in qualitative risk analysis. Answer: C is incorrect. Risks grouped by categories are part of the risk register updates. Answer: D is incorrect. Watchlist of low-priority risks is part of the risk register updates. Answer: A is incorrect. Trends in qualitative risk analysis are part of the risk register updates. Question No : 2 - (Topic 1) You are the risk official of your enterprise. Your enterprise takes important decisions without considering risk credential information and is also unaware of external requirements for risk management and integration with enterprise risk management. In which of the following risk management capability maturity levels does your enterprise exists? A. Level 1 B. Level 0 C. Level 5 D. Level 4

3. Answer: B Explanation: 0 nonexistent: An enterprise's risk management capability maturity level is 0 when: The enterprise does not recognize the need to consider the risk management or the business impact from IT risk. Decisions involving risk lack credible information. Awareness of external requirements for risk management and integration with enterprise risk management (ERM) do not exists. Answer:A, C, and D are incorrect. These all are much higher levels of the risk management capability maturity model and in all these enterprise do take decisions considering the risk credential information. Moreover, in these levels enterprise is aware of external requirements for risk management and integrate with ERM. Question No : 3 - (Topic 1) Which of following is NOT used for measurement of Critical Success Factors of the project? A. Productivity B. Quality C. Quantity D. Customer service Answer: C Explanation: Answer: A, B, and D are incorrect. Productivity, quality and customer service are used for evaluating critical service factor of any particular project. Topic 2, Volume B Question No : 4 - (Topic 2) Which of the following process ensures that the risk response strategy remains active and

4. that proposed controls are implemented according to schedule? A. Risk management B. Risk response integration C. Risk response implementation D. Risk response tracking Answer: D Explanation: Risk response tracking tracks the ongoing status of risk mitigation processes as part of risk response process. This tracking ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule. When an enterprise is conscious of a risk, but does not have an appropriate risk response strategy, then it lead to the increase of the liability of the organization to adverse publicity or even civil or criminal penalties. Answer: C is incorrect. Implementation of risk response ensures that the risks analyzed in risk analysis process are being lowered to level that the enterprise can accept, by applying appropriate controls. Answer: B is incorrect. Integrating risk response options to address more than one risk together, help in achieving greater efficiency. The use of techniques that are versatile and enterprise-wide, rather than individual solutions provides better justification for risk response strategies and related costs. Answer: A is incorrect. Risk management provides an approach for individuals and groups to make a decision on how to deal with potentially harmful situations Question No : 5 - (Topic 2) Risks to an organization's image are referred to as what kind of risk? A. Operational B. Financial C. Information D. Strategic Answer: D Explanation: Strategic risks are those risks which have potential outcome of not fulfilling on strategic objectives of the organization as planned. Since the strategic objective will shape and

5. impact the entire organization, the risk of not meeting that objective can impose a great threat on the organization. Strategic risks can be broken down into external and internal risks: External risks are those circumstances from outside the enterprise which will have a potentially damaging or helpful impact on the enterprise. These risks include sudden change of economy, industry, or regulatory conditions. Some of the external risks are predictable while others are not. For instance, a recession may be predictable and the enterprise may be able to hedge against the dangers economically; but the total market failure may not as predictable and can be much more devastating. Internal risks usually focus on the image or reputation of the enterprise. some of the risks that are involved in this are public communication, trust, and strategic agreement from stakeholders and customers. Reference: CRISC, Contents: "Assessing Risks" Answer: B is incorrect. Financial risks are not directly linked with organization's reputation. Answer: C is incorrect. Risk associated with leakage of information to an unauthorized person does not affect organization's image. Answer: A is incorrect. Operational risks are those risk that are associated with the day-to- day operations of the enterprise. They are generally more detailed as compared to strategic risks. It is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Some sub-categories of operational risks include: Organizational or management related risks Information security risks Production, process, and productivity risks Profitability operational risks Business interruption risks Project activity risks Contract and product liability riss Incidents and crisis Illegal or malicious acts

6. Question No : 6 - (Topic 2) You work as a project manager for BlueWell Inc. Your project is using a new material to construct a large warehouse in your city. This new material is cheaper than traditional building materials, but it takes some time to learn how to use the material properly. You have communicated to the project stakeholders that you will be able to save costs by using the new material, but you will need a few extra weeks to complete training to use the materials. This risk response of learning how to use the new materials can also be known as what term? A. Benchmarking B. Cost-benefits analysis C. Cost of conformance to quality D. Team development Answer: C Explanation: When the project team needs training to be able to complete the project work it is a cost of conformance to quality. The cost of conformance to quality defines the cost of training, proper resources, and the costs the project must spend in order to ascertain the expected levels of quality the customer expects from the project. It is the capital used up throughout the project to avoid failures. It consists of two types of costs: Prevention costs: It is measured to build a quality product. It includes costs in training, document processing, equipment , and time to do it right. Appraisal costs: It is measured to assess the quality. It includes testing, destructive testing loss, and inspections. Answer: D is incorrect. Team development describes activities the project manager uses to create a more cohesive and responsive project team. Answer: B is incorrect. Cost-benefit analysis is the study of the benefits in relation to the costs to receive the benefits of a decision, a project, or other investment. Answer: A is incorrect. Benchmarking compares any two items, such as materials, vendors, or resources. Topic 3, Volume C Question No : 7 - (Topic 3)

7. You work as a project manager for BlueWell Inc. You are involved with the project team on the different risk issues in your project. You are using the applications of IRGC model to facilitate the understanding and managing the rising of the overall risks that have impacts on the economy and society. One of your team members wants to know that what the need to use the IRGC is. What will be your reply? A. IRGC models aim at building robust, integrative inter-disciplinary governance models for emerging and existing risks. B. IRGC is both a concept and a tool. C. IRGC addresses the development of resilience and the capacity of organizations and people to face unavoidable risks. D. IRGC addresses understanding of the secondary impacts of a risk. Answer: A Explanation: IRGC is aimed at building robust, integrative inter-disciplinary governance models for emerging and existing risks. The International Risk Governance Council (IRGC) is a self-governing organization whose principle is to facilitate the understanding and managing the rising overall risks that have impacts on the economy and society, human health and safety, the environment at large. IRGC's effort is to build and develop concepts of risk governance, predict main risk issues and present risk governance policy recommendations for the chief decision makers. IRGC mainly emphasizes on rising, universal risks for which governance deficits exist. Its goal is to present recommendations for how policy makers can correct them. IRGC models at constructing strong, integrative inter-disciplinary governance models for up-coming and existing risks. Answer:B is incorrect. As IRGC is aimed at building robust, integrative inter-disciplinary governance models for emerging and existing risks, so it is the best answer for this options D and C are incorrect. Risk governance addresses understanding of the secondary impacts of a risk, the development of resilience and the capacity of organizations and people to face unavoidable risks. Question No : 8 - (Topic 3) You work as the project manager for Company Inc. The project on which you are working has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?

8. A. Resource Management Plan B. Communications Management Plan C. Risk Management Plan D. Stakeholder management strategy Answer: B Explanation: The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project. Answer:D is incorrect. The stakeholder management strategy does not address risk communications. Answer:C is incorrect. The Risk Management Plan deals with risk identification, analysis, response, and monitoring. Answer:A is incorrect. The Resource Management Plan does not define risk communications. Question No : 9 - (Topic 3) You are the project manager for TTP project. You are in the Identify Risks process. You have to create the risk register. Which of the following are included in the risk register? Each correct answer represents a complete solution. Choose two. A. List of potential responses B. List of key stakeholders C. List of mitigation techniques D. List of identified risks Answer: A,D Explanation: Risk register primarily contains the following:

9. List of identified risks: A reasonable description of the identified risks is noted in the risk register. The description includes event, cause, effect, impact related to the risks identified. In addition to the list of identified risks, the root causes of those risks may appear in the risk register. List of potential responses: Potential responses to a risk may be identified during the Identify Risks process. These responses are useful as inputs to the Plan Risk Responses process. Answer:C is incorrect. Risk register do contain the summary of mitigation, but only after the applying risk response. Here in this scenario you are in risk identification phase, hence mitigation techniques cannot be documented at this situation. Answer:B is incorrect. This is not valid content of risk register. A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains: A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved. Topic 4, Volume D Question No : 10 - (Topic 4) Adrian is a project manager for a new project using a technology that has recently been released and there's relatively little information about the technology. Initial testing of the technology makes the use of it look promising, but there's still uncertainty as to the longevity and reliability of the technology. Adrian wants to consider the technology factors a risk for her project. Where should she document the risks associated with this technology so she can track the risk status and responses? A. Project scope statement B. Project charter C. Risk low-level watch list

10. List of identified risks: A reasonable description of the identified risks is noted in the risk register. The description includes event, cause, effect, impact related to the risks identified. In addition to the list of identified risks, the root causes of those risks may appear in the risk register. List of potential responses: Potential responses to a risk may be identified during the Identify Risks process. These responses are useful as inputs to the Plan Risk Responses process. Answer:C is incorrect. Risk register do contain the summary of mitigation, but only after the applying risk response. Here in this scenario you are in risk identification phase, hence mitigation techniques cannot be documented at this situation. Answer:B is incorrect. This is not valid content of risk register. A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains: A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved. Topic 4, Volume D Question No : 10 - (Topic 4) Adrian is a project manager for a new project using a technology that has recently been released and there's relatively little information about the technology. Initial testing of the technology makes the use of it look promising, but there's still uncertainty as to the longevity and reliability of the technology. Adrian wants to consider the technology factors a risk for her project. Where should she document the risks associated with this technology so she can track the risk status and responses? A. Project scope statement B. Project charter C. Risk low-level watch list

11. D. Risk register Answer: D Explanation: A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains: A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved. It records the initial risks, the potential responses, and tracks the status of each identified risk in the project. Answer:B is incorrect. The project charter does not define risks. Answer:A is incorrect. The project scope statement does document initially defined risks but it is not a place that will record risks responses and status of risks. Answer:C is incorrect. The risk low-level watch list is for identified risks that have low impact and low probability in the project. Isaca Dumps PDF